Skip to contentSkip to conversation

Add support for NIST P521 to ecdsa

PATCH Superseded Stefan Berger 3 participants 28 messages Feb 23, 2024 – Mar 2, 2024

Subsystems (5)
Crypto API Arm STM32 Keys/keyrings Asymmetric keys +1 more subsystems

v3 of 5 Superseded Latest is v5 →

lore
Share & tools
lore

Stefan Berger

author reviewer
#0 lore raw

v3 cover Add support for NIST P521 to ecdsa

This series adds support for the NIST P521 curve to the ecdsa module.

An issue with the current code in ecdsa is that it assumes that input arrays providing key coordinates for example, are arrays of digits (a 'digit' is a 'u64'). This works well for all currently supported curves, such as NIST P192/256/384, but does not work for NIST P521 where coordinates are 8 digits + 2 bytes long. So some of the changes deal with converting byte arrays to digits and adjusting tests on input byte array lengths to tolerate arrays not providing multiples of 8 bytes.

Regards,
Stefan

v3:
- Dropped ecdh support
- Use ecc_get_curve_nbits for getting number of bits in NIST P521 curve in ecc_point_mult (7/10)

v2:
- Reformulated some patch descriptions
- Fixed issue detected by krobot
- Some other small changes to the code

Stefan Berger (10):
crypto: ecdsa - Convert byte arrays with key coordinates to digits
crypto: ecdsa - Adjust tests on length of key parameters
crypto: ecdsa - Extend res.x mod n calculation for NIST P521
crypto: ecc - Implement vli_mmod_fast_521 for NIST p521
crypto: ecc - Add nbits field to ecc_curve structure
crypte: ecc - Implement ecc_curve_get_nbits to get number of bits
crypto: ecc - Use ecc_get_curve_nbits to get number of bits for NIST

    P521

crypto: ecc - Add NIST P521 curve parameters
crypto: ecdsa - Register NIST P521 and extend test suite
x509: Add OID for NIST P521 and extend parser for it

 crypto/asymmetric_keys/x509_cert_parser.c |   3 +
 crypto/ecc.c                              |  38 +++++-
 crypto/ecc_curve_defs.h                   |  45 +++++++
 crypto/ecdsa.c                            |  48 +++++--
 crypto/testmgr.c                          |   7 ++
 crypto/testmgr.h                          | 146 ++++++++++++++++++++++
 include/crypto/ecc_curve.h                |   3 +
 include/crypto/ecdh.h                     |   1 +
 include/crypto/internal/ecc.h             |  32 ++++-
 include/linux/oid_registry.h              |   1 +
 10 files changed, 315 insertions(+), 9 deletions(-)
Signature · 1 line
2.43.0
author reviewer
#1 lore raw

PATCH v3 1/10 crypto: ecdsa - Convert byte arrays with key coordinates to digits

For NIST P192/256/384 the public key's x and y parameters could be copied directly from a given array since both parameters filled 'ndigits' of digits (a 'digit' is a u64). For support of NIST P521 the key parameters first have to be copied into a temporary byte array with leading zeros and can then be copied into the final digit array using ecc_swap_digits.

Implement ecc_digits_from_bytes to convert a byte array into an array of digits and use this function in ecdsa_set_pub_key where an input byte array needs to be converted into digits.

Signed-off-by Stefan Berger <[email protected]>
---
 crypto/ecdsa.c                | 14 +++++++++-----
 include/crypto/internal/ecc.h | 19 +++++++++++++++++++
 2 files changed, 28 insertions(+), 5 deletions(-)
crypto/ecdsa.c +9 -5
index fbd76498aba8..ba8fb76fd165 100644
@@ -222,9 +222,8 @@ static int ecdsa_ecc_ctx_reset(struct ecc_ctx *ctx)
 static int ecdsa_set_pub_key(struct crypto_akcipher *tfm, const void *key, unsigned int keylen)
 {
 	struct ecc_ctx *ctx = akcipher_tfm_ctx(tfm);
+	unsigned int digitlen, ndigits;
 	const unsigned char *d = key;
-	const u64 *digits = (const u64 *)&d[1];
-	unsigned int ndigits;
 	int ret;
 
 	ret = ecdsa_ecc_ctx_reset(ctx);

@@ -238,12 +237,17 @@ static int ecdsa_set_pub_key(struct crypto_akcipher *tfm, const void *key, unsig
 		return -EINVAL;
 
 	keylen--;
-	ndigits = (keylen >> 1) / sizeof(u64);
+	digitlen = keylen >> 1;
+
+	ndigits = digitlen / sizeof(u64);
 	if (ndigits != ctx->curve->g.ndigits)
 		return -EINVAL;
 
-	ecc_swap_digits(digits, ctx->pub_key.x, ndigits);
-	ecc_swap_digits(&digits[ndigits], ctx->pub_key.y, ndigits);
+	d++;
+
+	ecc_digits_from_bytes(d, digitlen, ctx->pub_key.x, ndigits);
+	ecc_digits_from_bytes(&d[digitlen], digitlen, ctx->pub_key.y, ndigits);
+
 	ret = ecc_is_pubkey_valid_full(ctx->curve, &ctx->pub_key);
 
 	ctx->pub_key_set = ret == 0;
include/crypto/internal/ecc.h +19 -0
index 4f6c1a68882f..bee3329af7de 100644
@@ -56,6 +56,25 @@ static inline void ecc_swap_digits(const void *in, u64 *out, unsigned int ndigit
 		out[i] = get_unaligned_be64(&src[ndigits - 1 - i]);
 }
 
+/**
+ * ecc_digits_from_bytes() - Create ndigits-sized digits array from byte array
+ * @in:       Input byte array
+ * @nbytes    Size of input byte array
+ * @out       Output digits array
+ * @ndigits:  Number of digits to create from byte array
+ */
+static inline void ecc_digits_from_bytes(const u8 *in, unsigned int nbytes,
+					 u64 *out, unsigned int ndigits)
+{
+	unsigned int sz = ndigits << ECC_DIGITS_TO_BYTES_SHIFT;
+	u8 tmp[ECC_MAX_DIGITS << ECC_DIGITS_TO_BYTES_SHIFT];
+	unsigned int o = sz - nbytes;
+
+	memset(tmp, 0, o);
+	memcpy(&tmp[o], in, nbytes);
+	ecc_swap_digits(tmp, out, ndigits);
+}
+
 /**
  * ecc_is_key_valid() - Validate a given ECDH private key
  *
Signature · 1 line
2.43.0
maintainer
#2 lore raw

Re: [PATCH v3 01/10] crypto: ecdsa - Convert byte arrays with key coordinates to digits

include/crypto/internal/ecc.h static inline void ecc_swap_digits(const void *in, u64 *out, unsigned int ndigit · line 76

Quoted 11 lines · Stefan Berger
include/crypto/internal/ecc.h +11 -0
+static inline void ecc_digits_from_bytes(const u8 *in, unsigned int nbytes,
+					 u64 *out, unsigned int ndigits)
+{
+	unsigned int sz = ndigits << ECC_DIGITS_TO_BYTES_SHIFT;
+	u8 tmp[ECC_MAX_DIGITS << ECC_DIGITS_TO_BYTES_SHIFT];
+	unsigned int o = sz - nbytes;
+
+	memset(tmp, 0, o);
+	memcpy(&tmp[o], in, nbytes);
+	ecc_swap_digits(tmp, out, ndigits);
+}

Copying the whole key into tmp seems inefficient. You only need special handling for the first few bytes of "in" (6 bytes in the P521 case) and could use ecc_swap_digits() to convert the rest of "in" directly to "out" without using tmp.

So it would be sufficient to allocate the first digit on the stack, memset + memcpy, then convert that to native byte order into "in[0]" and use ecc_swap_digits() for the rest.

And the special handling would be conditional on "!o", so is skipped for existing curves.

Thanks,

Lukas

author reviewer
#3 lore raw

Re: [PATCH v3 01/10] crypto: ecdsa - Convert byte arrays with key coordinates to digits

Quoted 18 lines · Lukas Wunner

include/crypto/internal/ecc.h static inline void ecc_swap_digits(const void *in, u64 *out, unsigned int ndigit · line 76

Quoted 11 lines · Stefan Berger
include/crypto/internal/ecc.h +11 -0
+static inline void ecc_digits_from_bytes(const u8 *in, unsigned int nbytes,
+					 u64 *out, unsigned int ndigits)
+{
+	unsigned int sz = ndigits << ECC_DIGITS_TO_BYTES_SHIFT;
+	u8 tmp[ECC_MAX_DIGITS << ECC_DIGITS_TO_BYTES_SHIFT];
+	unsigned int o = sz - nbytes;
+
+	memset(tmp, 0, o);
+	memcpy(&tmp[o], in, nbytes);
+	ecc_swap_digits(tmp, out, ndigits);
+}

Copying the whole key into tmp seems inefficient. You only need special handling for the first few bytes of "in" (6 bytes in the P521 case) and could use ecc_swap_digits() to convert the rest of "in" directly to "out" without using tmp.

Quoted 6 lines

So it would be sufficient to allocate the first digit on the stack, memset + memcpy, then convert that to native byte order into "in[0]" and use ecc_swap_digits() for the rest.

And the special handling would be conditional on "!o", so is skipped for existing curves.

Thanks. It looks like this now:

static inline void ecc_digits_from_bytes(const u8 *in, unsigned int nbytes,
u64 *out, unsigned int ndigits)

{
        unsigned int o = nbytes & 7;
        u64 msd = 0;
        size_t i;

        if (o == 0) {
                ecc_swap_digits(in, out, ndigits);
        } else {
                for (i = 0; i < o; i++)
                        msd = (msd << 8) | in[i];
                out[ndigits - 1] = msd;
                ecc_swap_digits(&in[o], out, ndigits - 1);
        }
}

Stefan

Quoted 4 lines

Thanks,

Lukas

maintainer
#4 lore raw

Re: [PATCH v3 01/10] crypto: ecdsa - Convert byte arrays with key coordinates to digits

Quoted 16 lines · Stefan Berger

static inline void ecc_digits_from_bytes(const u8 *in, unsigned int nbytes,
u64 *out, unsigned int ndigits)

{
        unsigned int o = nbytes & 7;
        u64 msd = 0;
        size_t i;

        if (o == 0) {
                ecc_swap_digits(in, out, ndigits);
        } else {
                for (i = 0; i < o; i++)
                        msd = (msd << 8) | in[i];
                out[ndigits - 1] = msd;
                ecc_swap_digits(&in[o], out, ndigits - 1);
        }
}

Might be beneficial to add a code comment explaining the else-branch is for curves with key length not a multiple of 64 bits (such as NIST P521).

Otherwise LGTM, thanks!

Lukas

author reviewer
#5 lore raw

Re: [PATCH v3 01/10] crypto: ecdsa - Convert byte arrays with key coordinates to digits

Quoted 18 lines · Lukas Wunner
Quoted 16 lines · Stefan Berger

static inline void ecc_digits_from_bytes(const u8 *in, unsigned int nbytes,
u64 *out, unsigned int ndigits)

{
         unsigned int o = nbytes & 7;
         u64 msd = 0;
         size_t i;

         if (o == 0) {
                 ecc_swap_digits(in, out, ndigits);
         } else {
                 for (i = 0; i < o; i++)
                         msd = (msd << 8) | in[i];
                 out[ndigits - 1] = msd;
                 ecc_swap_digits(&in[o], out, ndigits - 1);
         }
}
Quoted 2 lines

Might be beneficial to add a code comment explaining the else-branch is for curves with key length not a multiple of 64 bits (such as NIST P521).

Will do. I am also using this here now since it's safer: ecc_swap_digits(&in[o], out, (nbytes - o) >> 3);

Stefan

Quoted 4 lines

Otherwise LGTM, thanks!

Lukas

maintainer
#6 lore raw

Re: [PATCH v3 01/10] crypto: ecdsa - Convert byte arrays with key coordinates to digits

In reply to Stefan Berger
Quoted 32 lines · Stefan Berger
Quoted 18 lines · Lukas Wunner

include/crypto/internal/ecc.h static inline void ecc_swap_digits(const void *in, u64 *out, unsigned int ndigit · line 76

Quoted 11 lines · Stefan Berger
include/crypto/internal/ecc.h +11 -0
+static inline void ecc_digits_from_bytes(const u8 *in, unsigned int nbytes,
+					 u64 *out, unsigned int ndigits)
+{
+	unsigned int sz = ndigits << ECC_DIGITS_TO_BYTES_SHIFT;
+	u8 tmp[ECC_MAX_DIGITS << ECC_DIGITS_TO_BYTES_SHIFT];
+	unsigned int o = sz - nbytes;
+
+	memset(tmp, 0, o);
+	memcpy(&tmp[o], in, nbytes);
+	ecc_swap_digits(tmp, out, ndigits);
+}

Copying the whole key into tmp seems inefficient. You only need special handling for the first few bytes of "in" (6 bytes in the P521 case) and could use ecc_swap_digits() to convert the rest of "in" directly to "out" without using tmp.

Quoted 6 lines

So it would be sufficient to allocate the first digit on the stack, memset + memcpy, then convert that to native byte order into "in[0]" and use ecc_swap_digits() for the rest.

And the special handling would be conditional on "!o", so is skipped for existing curves.

Thanks. It looks like this now:

static inline void ecc_digits_from_bytes(const u8 *in, unsigned int nbytes,
u64 *out, unsigned int ndigits)

Quoted 12 lines
{
         unsigned int o = nbytes & 7;
         u64 msd = 0;
         size_t i;

         if (o == 0) {
                 ecc_swap_digits(in, out, ndigits);
         } else {
                 for (i = 0; i < o; i++)
                         msd = (msd << 8) | in[i];
                 out[ndigits - 1] = msd;
                 ecc_swap_digits(&in[o], out, ndigits - 1);

This would be more stream-lined IMHO:

        unsigned int o = nbytes & 7;
	unsigned int n = ndigits;
        u64 msd = 0;
        size_t i;

        if (o != 0) {
                for (i = 0; i < o; i++)
                        msd = (msd << 8) | in[i];

                out[--n] = msd;
        }

        ecc_swap_digits(in, out, n);

BR, Jarkko

author reviewer
#7 lore raw

Re: [PATCH v3 01/10] crypto: ecdsa - Convert byte arrays with key coordinates to digits

Quoted 48 lines · Jarkko Sakkinen
Quoted 32 lines · Stefan Berger
Quoted 18 lines · Lukas Wunner

include/crypto/internal/ecc.h static inline void ecc_swap_digits(const void *in, u64 *out, unsigned int ndigit · line 76

Quoted 11 lines · Stefan Berger
include/crypto/internal/ecc.h +11 -0
+static inline void ecc_digits_from_bytes(const u8 *in, unsigned int nbytes,
+					 u64 *out, unsigned int ndigits)
+{
+	unsigned int sz = ndigits << ECC_DIGITS_TO_BYTES_SHIFT;
+	u8 tmp[ECC_MAX_DIGITS << ECC_DIGITS_TO_BYTES_SHIFT];
+	unsigned int o = sz - nbytes;
+
+	memset(tmp, 0, o);
+	memcpy(&tmp[o], in, nbytes);
+	ecc_swap_digits(tmp, out, ndigits);
+}

Copying the whole key into tmp seems inefficient. You only need special handling for the first few bytes of "in" (6 bytes in the P521 case) and could use ecc_swap_digits() to convert the rest of "in" directly to "out" without using tmp.

Quoted 6 lines

So it would be sufficient to allocate the first digit on the stack, memset + memcpy, then convert that to native byte order into "in[0]" and use ecc_swap_digits() for the rest.

And the special handling would be conditional on "!o", so is skipped for existing curves.

Thanks. It looks like this now:

static inline void ecc_digits_from_bytes(const u8 *in, unsigned int nbytes,
u64 *out, unsigned int ndigits)

Quoted 12 lines
{
          unsigned int o = nbytes & 7;
          u64 msd = 0;
          size_t i;

          if (o == 0) {
                  ecc_swap_digits(in, out, ndigits);
          } else {
                  for (i = 0; i < o; i++)
                          msd = (msd << 8) | in[i];
                  out[ndigits - 1] = msd;
                  ecc_swap_digits(&in[o], out, ndigits - 1);

This would be more stream-lined IMHO:

Quoted 13 lines
         unsigned int o = nbytes & 7;
	unsigned int n = ndigits;
         u64 msd = 0;
         size_t i;

         if (o != 0) {
                 for (i = 0; i < o; i++)
                         msd = (msd << 8) | in[i];

                 out[--n] = msd;
         }

         ecc_swap_digits(in, out, n);

You forgot to advance 'in'.

Quoted 3 lines

BR, Jarkko

maintainer
#8 lore raw

Re: [PATCH v3 01/10] crypto: ecdsa - Convert byte arrays with key coordinates to digits

Quoted 60 lines · Stefan Berger
Quoted 57 lines · Jarkko Sakkinen
Quoted 32 lines · Stefan Berger
Quoted 18 lines · Lukas Wunner

include/crypto/internal/ecc.h static inline void ecc_swap_digits(const void *in, u64 *out, unsigned int ndigit · line 76

Quoted 11 lines · Stefan Berger
include/crypto/internal/ecc.h +11 -0
+static inline void ecc_digits_from_bytes(const u8 *in, unsigned int nbytes,
+					 u64 *out, unsigned int ndigits)
+{
+	unsigned int sz = ndigits << ECC_DIGITS_TO_BYTES_SHIFT;
+	u8 tmp[ECC_MAX_DIGITS << ECC_DIGITS_TO_BYTES_SHIFT];
+	unsigned int o = sz - nbytes;
+
+	memset(tmp, 0, o);
+	memcpy(&tmp[o], in, nbytes);
+	ecc_swap_digits(tmp, out, ndigits);
+}

Copying the whole key into tmp seems inefficient. You only need special handling for the first few bytes of "in" (6 bytes in the P521 case) and could use ecc_swap_digits() to convert the rest of "in" directly to "out" without using tmp.

Quoted 6 lines

So it would be sufficient to allocate the first digit on the stack, memset + memcpy, then convert that to native byte order into "in[0]" and use ecc_swap_digits() for the rest.

And the special handling would be conditional on "!o", so is skipped for existing curves.

Thanks. It looks like this now:

static inline void ecc_digits_from_bytes(const u8 *in, unsigned int nbytes,
u64 *out, unsigned int ndigits)

Quoted 12 lines
{
          unsigned int o = nbytes & 7;
          u64 msd = 0;
          size_t i;

          if (o == 0) {
                  ecc_swap_digits(in, out, ndigits);
          } else {
                  for (i = 0; i < o; i++)
                          msd = (msd << 8) | in[i];
                  out[ndigits - 1] = msd;
                  ecc_swap_digits(&in[o], out, ndigits - 1);

This would be more stream-lined IMHO:

         unsigned int o = nbytes & 7;
	unsigned int n = ndigits;
         u64 msd = 0;
         size_t i;

         if (o != 0) {
                 for (i = 0; i < o; i++)
                         msd = (msd << 8) | in[i];
Quoted 6 lines
Quoted 4 lines
                 out[--n] = msd;
         }

         ecc_swap_digits(in, out, n);

You forgot to advance 'in'.

yeah, pointing out that two call sites is unnecessary complexity, that's all

BR, Jarkko

maintainer
#9 lore raw

Re: [PATCH v3 01/10] crypto: ecdsa - Convert byte arrays with key coordinates to digits

In reply to Jarkko Sakkinen
Quoted 48 lines · Jarkko Sakkinen
Quoted 32 lines · Stefan Berger
Quoted 18 lines · Lukas Wunner

include/crypto/internal/ecc.h static inline void ecc_swap_digits(const void *in, u64 *out, unsigned int ndigit · line 76

Quoted 11 lines · Stefan Berger
include/crypto/internal/ecc.h +11 -0
+static inline void ecc_digits_from_bytes(const u8 *in, unsigned int nbytes,
+					 u64 *out, unsigned int ndigits)
+{
+	unsigned int sz = ndigits << ECC_DIGITS_TO_BYTES_SHIFT;
+	u8 tmp[ECC_MAX_DIGITS << ECC_DIGITS_TO_BYTES_SHIFT];
+	unsigned int o = sz - nbytes;
+
+	memset(tmp, 0, o);
+	memcpy(&tmp[o], in, nbytes);
+	ecc_swap_digits(tmp, out, ndigits);
+}

Copying the whole key into tmp seems inefficient. You only need special handling for the first few bytes of "in" (6 bytes in the P521 case) and could use ecc_swap_digits() to convert the rest of "in" directly to "out" without using tmp.

Quoted 6 lines

So it would be sufficient to allocate the first digit on the stack, memset + memcpy, then convert that to native byte order into "in[0]" and use ecc_swap_digits() for the rest.

And the special handling would be conditional on "!o", so is skipped for existing curves.

Thanks. It looks like this now:

static inline void ecc_digits_from_bytes(const u8 *in, unsigned int nbytes,
u64 *out, unsigned int ndigits)

Quoted 12 lines
{
         unsigned int o = nbytes & 7;
         u64 msd = 0;
         size_t i;

         if (o == 0) {
                 ecc_swap_digits(in, out, ndigits);
         } else {
                 for (i = 0; i < o; i++)
                         msd = (msd << 8) | in[i];
                 out[ndigits - 1] = msd;
                 ecc_swap_digits(&in[o], out, ndigits - 1);

This would be more stream-lined IMHO:

Quoted 13 lines
        unsigned int o = nbytes & 7;
        unsigned int n = ndigits;
        u64 msd = 0;
        size_t i;

        if (o != 0) {
                for (i = 0; i < o; i++)
                        msd = (msd << 8) | in[i];

                out[--n] = msd;
        }

        ecc_swap_digits(in, out, n);

Maybe eliminate the for-loop as well?

	unsigned int o = nbytes & 7;
	u64 msd = 0;

	if (o != 0) {
		/* if key length is not a multiple of 64 bits (NIST P521) */
		memcpy((u8 *)&msd + sizeof(msd) - o, in, o);
		out[--ndigits] = be64_to_cpu(msd);
		in += o;
	}

	ecc_swap_digits(in, out, ndigits);
author reviewer
#10 lore raw

Re: [PATCH v3 01/10] crypto: ecdsa - Convert byte arrays with key coordinates to digits

Quoted 65 lines · Lukas Wunner
Quoted 48 lines · Jarkko Sakkinen
Quoted 32 lines · Stefan Berger
Quoted 18 lines · Lukas Wunner

include/crypto/internal/ecc.h static inline void ecc_swap_digits(const void *in, u64 *out, unsigned int ndigit · line 76

Quoted 11 lines · Stefan Berger
include/crypto/internal/ecc.h +11 -0
+static inline void ecc_digits_from_bytes(const u8 *in, unsigned int nbytes,
+					 u64 *out, unsigned int ndigits)
+{
+	unsigned int sz = ndigits << ECC_DIGITS_TO_BYTES_SHIFT;
+	u8 tmp[ECC_MAX_DIGITS << ECC_DIGITS_TO_BYTES_SHIFT];
+	unsigned int o = sz - nbytes;
+
+	memset(tmp, 0, o);
+	memcpy(&tmp[o], in, nbytes);
+	ecc_swap_digits(tmp, out, ndigits);
+}

Copying the whole key into tmp seems inefficient. You only need special handling for the first few bytes of "in" (6 bytes in the P521 case) and could use ecc_swap_digits() to convert the rest of "in" directly to "out" without using tmp.

Quoted 6 lines

So it would be sufficient to allocate the first digit on the stack, memset + memcpy, then convert that to native byte order into "in[0]" and use ecc_swap_digits() for the rest.

And the special handling would be conditional on "!o", so is skipped for existing curves.

Thanks. It looks like this now:

static inline void ecc_digits_from_bytes(const u8 *in, unsigned int nbytes,
u64 *out, unsigned int ndigits)

Quoted 12 lines
{
          unsigned int o = nbytes & 7;
          u64 msd = 0;
          size_t i;

          if (o == 0) {
                  ecc_swap_digits(in, out, ndigits);
          } else {
                  for (i = 0; i < o; i++)
                          msd = (msd << 8) | in[i];
                  out[ndigits - 1] = msd;
                  ecc_swap_digits(&in[o], out, ndigits - 1);

This would be more stream-lined IMHO:

Quoted 13 lines
         unsigned int o = nbytes & 7;
         unsigned int n = ndigits;
         u64 msd = 0;
         size_t i;

         if (o != 0) {
                 for (i = 0; i < o; i++)
                         msd = (msd << 8) | in[i];

                 out[--n] = msd;
         }

         ecc_swap_digits(in, out, n);

Maybe eliminate the for-loop as well?

Quoted 12 lines
	unsigned int o = nbytes & 7;
	u64 msd = 0;

	if (o != 0) {
		/* if key length is not a multiple of 64 bits (NIST P521) */
		memcpy((u8 *)&msd + sizeof(msd) - o, in, o);
		out[--ndigits] = be64_to_cpu(msd);
		in += o;
	}

	ecc_swap_digits(in, out, ndigits);

Will take this for v5 with your Suggested-by:, ok?

Stefan

maintainer
#11 lore raw

Re: [PATCH v3 01/10] crypto: ecdsa - Convert byte arrays with key coordinates to digits

Quoted 13 lines · Stefan Berger
Quoted 12 lines · Lukas Wunner

Maybe eliminate the for-loop as well?

	unsigned int o = nbytes & 7;
	u64 msd = 0;

	if (o != 0) {
		/* if key length is not a multiple of 64 bits (NIST P521) */
		memcpy((u8 *)&msd + sizeof(msd) - o, in, o);
		out[--ndigits] = be64_to_cpu(msd);
		in += o;
	}
Quoted 3 lines
Quoted 1 line
	ecc_swap_digits(in, out, ndigits);

Will take this for v5 with your Suggested-by:, ok?

Sure, feel free to, but better test it because I haven't. :-)

I'll look through the rest of the series tomorrow. %-)

Thanks,

Lukas

maintainer
#12 lore raw

Re: [PATCH v3 01/10] crypto: ecdsa - Convert byte arrays with key coordinates to digits

In reply to Lukas Wunner
Quoted 65 lines · Lukas Wunner
Quoted 48 lines · Jarkko Sakkinen
Quoted 32 lines · Stefan Berger
Quoted 18 lines · Lukas Wunner

include/crypto/internal/ecc.h static inline void ecc_swap_digits(const void *in, u64 *out, unsigned int ndigit · line 76

Quoted 11 lines · Stefan Berger
include/crypto/internal/ecc.h +11 -0
+static inline void ecc_digits_from_bytes(const u8 *in, unsigned int nbytes,
+					 u64 *out, unsigned int ndigits)
+{
+	unsigned int sz = ndigits << ECC_DIGITS_TO_BYTES_SHIFT;
+	u8 tmp[ECC_MAX_DIGITS << ECC_DIGITS_TO_BYTES_SHIFT];
+	unsigned int o = sz - nbytes;
+
+	memset(tmp, 0, o);
+	memcpy(&tmp[o], in, nbytes);
+	ecc_swap_digits(tmp, out, ndigits);
+}

Copying the whole key into tmp seems inefficient. You only need special handling for the first few bytes of "in" (6 bytes in the P521 case) and could use ecc_swap_digits() to convert the rest of "in" directly to "out" without using tmp.

Quoted 6 lines

So it would be sufficient to allocate the first digit on the stack, memset + memcpy, then convert that to native byte order into "in[0]" and use ecc_swap_digits() for the rest.

And the special handling would be conditional on "!o", so is skipped for existing curves.

Thanks. It looks like this now:

static inline void ecc_digits_from_bytes(const u8 *in, unsigned int nbytes,
u64 *out, unsigned int ndigits)

Quoted 12 lines
{
         unsigned int o = nbytes & 7;
         u64 msd = 0;
         size_t i;

         if (o == 0) {
                 ecc_swap_digits(in, out, ndigits);
         } else {
                 for (i = 0; i < o; i++)
                         msd = (msd << 8) | in[i];
                 out[ndigits - 1] = msd;
                 ecc_swap_digits(&in[o], out, ndigits - 1);

This would be more stream-lined IMHO:

Quoted 13 lines
        unsigned int o = nbytes & 7;
        unsigned int n = ndigits;
        u64 msd = 0;
        size_t i;

        if (o != 0) {
                for (i = 0; i < o; i++)
                        msd = (msd << 8) | in[i];

                out[--n] = msd;
        }

        ecc_swap_digits(in, out, n);

Maybe eliminate the for-loop as well?

Quoted 11 lines
	unsigned int o = nbytes & 7;
	u64 msd = 0;

	if (o != 0) {
		/* if key length is not a multiple of 64 bits (NIST P521) */
		memcpy((u8 *)&msd + sizeof(msd) - o, in, o);
		out[--ndigits] = be64_to_cpu(msd);
		in += o;
	}

	ecc_swap_digits(in, out, ndigits);

+1

BR, Jarkko

author reviewer
#13 lore raw

PATCH v3 2/10 crypto: ecdsa - Adjust tests on length of key parameters

In reply to Stefan Berger

In preparation for support of NIST P521, adjust the basic tests on the length of the provided key parameters to only ensure that the length of the x plus y coordinates parameter array is not an odd number and that each coordinate fits into an array of 'ndigits' digits. Mathematical tests on the key's parameters are then done in ecc_is_pubkey_valid_full rejecting invalid keys.

The change is necessary since NIST P521 keys do not have keys with coordinates that each fully require 'full' digits (= u64), unlike NIST P192/256/384 that all require multiple 'full' digits.

Signed-off-by Stefan Berger <[email protected]>
---
 crypto/ecdsa.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
crypto/ecdsa.c +2 -2
index ba8fb76fd165..64e1e69d53ba 100644
@@ -230,7 +230,7 @@ static int ecdsa_set_pub_key(struct crypto_akcipher *tfm, const void *key, unsig
 	if (ret < 0)
 		return ret;
 
-	if (keylen < 1 || (((keylen - 1) >> 1) % sizeof(u64)) != 0)
+	if (keylen < 1 || ((keylen - 1) & 1) != 0)
 		return -EINVAL;
 	/* we only accept uncompressed format indicated by '4' */
 	if (d[0] != 4)

@@ -239,7 +239,7 @@ static int ecdsa_set_pub_key(struct crypto_akcipher *tfm, const void *key, unsig
 	keylen--;
 	digitlen = keylen >> 1;
 
-	ndigits = digitlen / sizeof(u64);
+	ndigits = DIV_ROUND_UP(digitlen, sizeof(u64));
 	if (ndigits != ctx->curve->g.ndigits)
 		return -EINVAL;
Signature · 1 line
2.43.0
maintainer
#14 lore raw

Re: [PATCH v3 02/10] crypto: ecdsa - Adjust tests on length of key parameters

crypto/ecdsa.c static int ecdsa_set_pub_key(struct crypto_akcipher *tfm, const void *key, unsig · line 244

Quoted 8 lines · Stefan Berger
crypto/ecdsa.c +1 -1
@@ -239,7 +239,7 @@ static int ecdsa_set_pub_key(struct crypto_akcipher *tfm, const void *key, unsig
 	keylen--;
 	digitlen = keylen >> 1;
 
-	ndigits = digitlen / sizeof(u64);
+	ndigits = DIV_ROUND_UP(digitlen, sizeof(u64));
 	if (ndigits != ctx->curve->g.ndigits)
 		return -EINVAL;

This deletes a line inserted by the preceding patch in the series. I'd prefer just squashing the two patches together.

Thanks,

Lukas

author reviewer
#15 lore raw

Re: [PATCH v3 02/10] crypto: ecdsa - Adjust tests on length of key parameters

Quoted 5 lines · Lukas Wunner
Quoted 4 lines · Stefan Berger
crypto/ecdsa.c +0 -0
@@ -239,7 +239,7 @@ static int ecdsa_set_pub_key(struct crypto_akcipher *tfm, const void *key, unsig
  	keylen--;
  	digitlen = keylen >> 1;
Quoted 8 lines

crypto/ecdsa.c static int ecdsa_set_pub_key(struct crypto_akcipher *tfm, const void *key, unsig · line 244

Quoted 4 lines
crypto/ecdsa.c +1 -1
-	ndigits = digitlen / sizeof(u64);
+	ndigits = DIV_ROUND_UP(digitlen, sizeof(u64));
  	if (ndigits != ctx->curve->g.ndigits)
  		return -EINVAL;

This deletes a line inserted by the preceding patch in the series. I'd prefer just squashing the two patches together.

Hm, I moved this part here into 1/10 and left he other hunk in 2/10 since they deal with slightly different issues.

Stefan

Quoted 3 lines

Thanks,

Lukas

author reviewer
#16 lore raw

PATCH v3 3/10 crypto: ecdsa - Extend res.x mod n calculation for NIST P521

In reply to Stefan Berger

res.x has been calculated by ecc_point_mult_shamir, which uses 'mod curve_prime'. The curve_prime 'p' is typically larger than the curve_order 'n' and therefore it is possible that p > res.x >= n.

If res.x >= n then res.x mod n can be calculated by iteratively sub- tracting n from res.x until n > res.x. For NIST P192/256/384 this can be done in a single subtraction. This can also be done in a single subtraction for NIST P521.

The mathematical reason why a single subtraction is sufficient is due to the values of 'p' and 'n' of the NIST curves where the following holds true:

note: max(res.x) = p - 1

max(res.x) - n < n
p - 1 - n < n
p - 1 < 2n => true for the NIST curves

Signed-off-by Stefan Berger <[email protected]>
---
 crypto/ecdsa.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
crypto/ecdsa.c +1 -1
index 64e1e69d53ba..1814f009f971 100644
@@ -122,7 +122,7 @@ static int _ecdsa_verify(struct ecc_ctx *ctx, const u64 *hash, const u64 *r, con
 
 	/* res.x = res.x mod n (if res.x > order) */
 	if (unlikely(vli_cmp(res.x, curve->n, ndigits) == 1))
-		/* faster alternative for NIST p384, p256 & p192 */
+		/* faster alternative for NIST p521, p384, p256 & p192 */
 		vli_sub(res.x, res.x, curve->n, ndigits);
 
 	if (!vli_cmp(res.x, r, ndigits))
Signature · 1 line
2.43.0
author reviewer
#17 lore raw

PATCH v3 4/10 crypto: ecc - Implement vli_mmod_fast_521 for NIST p521

In reply to Stefan Berger

Implement vli_mmod_fast_521 following the description for how to calculate the modulus for NIST P521 in the NIST publication "Recommendations for Discrete Logarithm-Based Cryptography: Elliptic Curve Domain Parameters" section G.1.4.

NIST p521 requires 9 64bit digits, so increase the ECC_MAX_DIGITS so that arrays fit the larger numbers.

Signed-off-by Stefan Berger <[email protected]>
---
 crypto/ecc.c                  | 31 +++++++++++++++++++++++++++++++
 include/crypto/internal/ecc.h |  2 +-
 2 files changed, 32 insertions(+), 1 deletion(-)
crypto/ecc.c +31 -0
index f53fb4d6af99..ea7b28b5e00e 100644
@@ -902,6 +902,31 @@ static void vli_mmod_fast_384(u64 *result, const u64 *product,
 #undef AND64H
 #undef AND64L
 
+/* Computes result = product % curve_prime
+ * from "Recommendations for Discrete Logarithm-Based Cryptography:
+ *       Elliptic Curve Domain Parameters" G.1.4
+ */
+static void vli_mmod_fast_521(u64 *result, const u64 *product,
+				const u64 *curve_prime, u64 *tmp)
+{
+	const unsigned int ndigits = 9;
+	size_t i;
+
+	for (i = 0; i < ndigits; i++)
+		tmp[i] = product[i];
+	tmp[8] &= 0x1ff;
+
+	vli_set(result, tmp, ndigits);
+
+
+	for (i = 0; i < ndigits; i++)
+		tmp[i] = (product[8 + i] >> 9) | (product[9 + i] << 55);
+	tmp[8] &= 0x1ff;
+
+	vli_mod_add(result, result, tmp, curve_prime, ndigits);
+}
+
+
 /* Computes result = product % curve_prime for different curve_primes.
  *
  * Note that curve_primes are distinguished just by heuristic check and

@@ -941,6 +966,12 @@ static bool vli_mmod_fast(u64 *result, u64 *product,
 	case 6:
 		vli_mmod_fast_384(result, product, curve_prime, tmp);
 		break;
+	case 9:
+		if (!strcmp(curve->name, "nist_521")) {
+			vli_mmod_fast_521(result, product, curve_prime, tmp);
+			break;
+		}
+		fallthrough;
 	default:
 		pr_err_ratelimited("ecc: unsupported digits size!\n");
 		return false;
include/crypto/internal/ecc.h +1 -1
index bee3329af7de..b8ca5023b3b5 100644
@@ -33,7 +33,7 @@
 #define ECC_CURVE_NIST_P192_DIGITS  3
 #define ECC_CURVE_NIST_P256_DIGITS  4
 #define ECC_CURVE_NIST_P384_DIGITS  6
-#define ECC_MAX_DIGITS              (512 / 64) /* due to ecrdsa */
+#define ECC_MAX_DIGITS              (576 / 64) /* due to NIST P521 */
 
 #define ECC_DIGITS_TO_BYTES_SHIFT 3
Signature · 1 line
2.43.0
author reviewer
#18 lore raw

PATCH v3 5/10 crypto: ecc - Add nbits field to ecc_curve structure

In reply to Stefan Berger

Add the number of bits a curve has to the ecc_curve definition. This field only needs to be set for curves that don't fill up all bytes in their digits, such as NIST P521 which has only 9 bits in the most significant digit. This field will be used to determine the number of bytes a curve requires for its key coordinates for example.

Signed-off-by Stefan Berger <[email protected]>
---
 include/crypto/ecc_curve.h | 3 +++
 1 file changed, 3 insertions(+)
include/crypto/ecc_curve.h +3 -0
index 70964781eb68..337a44956926 100644
@@ -23,6 +23,8 @@ struct ecc_point {
  * struct ecc_curve - definition of elliptic curve
  *
  * @name:	Short name of the curve.
+ * @nbits:      Curves that do not use all bits in their ndigits must specify
+ *              their number of bits here, otherwise can leave at 0.
  * @g:		Generator point of the curve.
  * @p:		Prime number, if Barrett's reduction is used for this curve
  *		pre-calculated value 'mu' is appended to the @p after ndigits.

@@ -34,6 +36,7 @@ struct ecc_point {
  */
 struct ecc_curve {
 	char *name;
+	unsigned int nbits;
 	struct ecc_point g;
 	u64 *p;
 	u64 *n;
Signature · 1 line
2.43.0
author reviewer
#19 lore raw

PATCH v3 6/10 crypte: ecc - Implement ecc_curve_get_nbits to get number of bits

In reply to Stefan Berger

If curve->nbits is set then return this number, otherwise use the curve->ndigits to calculate the number of bits.

Signed-off-by Stefan Berger <[email protected]>
---
 include/crypto/internal/ecc.h | 11 +++++++++++
 1 file changed, 11 insertions(+)
include/crypto/internal/ecc.h +11 -0
index b8ca5023b3b5..2d321b47d0f7 100644
@@ -75,6 +75,17 @@ static inline void ecc_digits_from_bytes(const u8 *in, unsigned int nbytes,
 	ecc_swap_digits(tmp, out, ndigits);
 }
 
+/**
+ * ecc_curve_get_nbits() - Get the number of bits of the curve
+ * @curve:    The curve
+ */
+static inline unsigned int ecc_curve_get_nbits(const struct ecc_curve *curve)
+{
+	if (curve->nbits)
+		return curve->nbits;
+	return curve->g.ndigits << ECC_DIGITS_TO_BYTES_SHIFT * 8;
+}
+
 /**
  * ecc_is_key_valid() - Validate a given ECDH private key
  *
Signature · 1 line
2.43.0
maintainer
#20 lore raw

Re: [PATCH v3 06/10] crypte: ecc - Implement ecc_curve_get_nbits to get number of bits

Quoted 6 lines · Stefan Berger
include/crypto/internal/ecc.h +0 -0
@@ -75,6 +75,17 @@ static inline void ecc_digits_from_bytes(const u8 *in, unsigned int nbytes,
 	ecc_swap_digits(tmp, out, ndigits);
 }

include/crypto/internal/ecc.h static inline void ecc_digits_from_bytes(const u8 *in, unsigned int nbytes, · line 87

Quoted 10 lines
include/crypto/internal/ecc.h +10 -0
+/**
+ * ecc_curve_get_nbits() - Get the number of bits of the curve
+ * @curve:    The curve
+ */
+static inline unsigned int ecc_curve_get_nbits(const struct ecc_curve *curve)
+{
+	if (curve->nbits)
+		return curve->nbits;
+	return curve->g.ndigits << ECC_DIGITS_TO_BYTES_SHIFT * 8;
+}

Since you're amending struct ecc_curve with an extra nbits value anyway, why not statically fill it in for all curves, instead of adding this extra complexity in the code?

Thanks,

Lukas

author reviewer
#21 lore raw

Re: [PATCH v3 06/10] crypte: ecc - Implement ecc_curve_get_nbits to get number of bits

Quoted 7 lines · Lukas Wunner
Quoted 6 lines · Stefan Berger
include/crypto/internal/ecc.h +0 -0
@@ -75,6 +75,17 @@ static inline void ecc_digits_from_bytes(const u8 *in, unsigned int nbytes,
  	ecc_swap_digits(tmp, out, ndigits);
  }
Quoted 14 lines

include/crypto/internal/ecc.h static inline void ecc_digits_from_bytes(const u8 *in, unsigned int nbytes, · line 87

Quoted 10 lines
include/crypto/internal/ecc.h +10 -0
+/**
+ * ecc_curve_get_nbits() - Get the number of bits of the curve
+ * @curve:    The curve
+ */
+static inline unsigned int ecc_curve_get_nbits(const struct ecc_curve *curve)
+{
+	if (curve->nbits)
+		return curve->nbits;
+	return curve->g.ndigits << ECC_DIGITS_TO_BYTES_SHIFT * 8;
+}

Since you're amending struct ecc_curve with an extra nbits value anyway, why not statically fill it in for all curves, instead of adding this extra complexity in the code?

I filled in all curves now, including ecrdsa cruves and curve25519.

Stefan

Quoted 4 lines

Thanks,

Lukas

author reviewer
#22 lore raw

PATCH v3 7/10 crypto: ecc - Use ecc_get_curve_nbits to get number of bits for NIST P521

In reply to Stefan Berger

In ecc_point_mult query for the number of bits when using NIST P521 and add '2'. The change is required specifically for NIST P521 to pass mathematical tests on the public key.

Signed-off-by Stefan Berger <[email protected]>
---
 crypto/ecc.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)
crypto/ecc.c +4 -1
index ea7b28b5e00e..89ad45cf2404 100644
@@ -1326,7 +1326,10 @@ static void ecc_point_mult(struct ecc_point *result,
 	carry = vli_add(sk[0], scalar, curve->n, ndigits);
 	vli_add(sk[1], sk[0], curve->n, ndigits);
 	scalar = sk[!carry];
-	num_bits = sizeof(u64) * ndigits * 8 + 1;
+	if (ndigits == 9 && !strcmp(curve->name, "nist_521"))
+		num_bits = ecc_curve_get_nbits(curve) + 2;
+	else
+		num_bits = sizeof(u64) * ndigits * 8 + 1;
 
 	vli_set(rx[1], point->x, ndigits);
 	vli_set(ry[1], point->y, ndigits);
Signature · 1 line
2.43.0
author reviewer
#23 lore raw

PATCH v3 8/10 crypto: ecc - Add NIST P521 curve parameters

In reply to Stefan Berger

Add the parameters for the NIST P521 curve and define a new curve ID for it. Make the curve available in ecc_get_curve.

Signed-off-by Stefan Berger <[email protected]>
---
 crypto/ecc.c            |  2 ++
 crypto/ecc_curve_defs.h | 45 +++++++++++++++++++++++++++++++++++++++++
 include/crypto/ecdh.h   |  1 +
 3 files changed, 48 insertions(+)
crypto/ecc.c +2 -0
index 89ad45cf2404..164898ad1961 100644
@@ -60,6 +60,8 @@ const struct ecc_curve *ecc_get_curve(unsigned int curve_id)
 		return &nist_p256;
 	case ECC_CURVE_NIST_P384:
 		return &nist_p384;
+	case ECC_CURVE_NIST_P521:
+		return &nist_p521;
 	default:
 		return NULL;
 	}
crypto/ecc_curve_defs.h +45 -0

51 lines not on this page · raw message

include/crypto/ecdh.h +1 -0
index a9f98078d29c..9784ecdd2fb4 100644
@@ -26,6 +26,7 @@
 #define ECC_CURVE_NIST_P192	0x0001
 #define ECC_CURVE_NIST_P256	0x0002
 #define ECC_CURVE_NIST_P384	0x0003
+#define ECC_CURVE_NIST_P521	0x0004
 
 /**
  * struct ecdh - define an ECDH private key
Signature · 1 line
2.43.0
author reviewer
#24 lore raw

PATCH v3 9/10 crypto: ecdsa - Register NIST P521 and extend test suite

In reply to Stefan Berger

Register NIST P521 as an akcipher and extend the testmgr with NIST P521-specific test vectors.

Signed-off-by Stefan Berger <[email protected]>
---
 crypto/ecdsa.c   |  30 ++++++++++
 crypto/testmgr.c |   7 +++
 crypto/testmgr.h | 146 +++++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 183 insertions(+)
crypto/ecdsa.c +30 -0
index 1814f009f971..faa55c692d2a 100644
@@ -269,6 +269,28 @@ static unsigned int ecdsa_max_size(struct crypto_akcipher *tfm)
 	return ctx->pub_key.ndigits << ECC_DIGITS_TO_BYTES_SHIFT;
 }
 
+static int ecdsa_nist_p521_init_tfm(struct crypto_akcipher *tfm)
+{
+	struct ecc_ctx *ctx = akcipher_tfm_ctx(tfm);
+
+	return ecdsa_ecc_ctx_init(ctx, ECC_CURVE_NIST_P521);
+}
+
+static struct akcipher_alg ecdsa_nist_p521 = {
+	.verify = ecdsa_verify,
+	.set_pub_key = ecdsa_set_pub_key,
+	.max_size = ecdsa_max_size,
+	.init = ecdsa_nist_p521_init_tfm,
+	.exit = ecdsa_exit_tfm,
+	.base = {
+		.cra_name = "ecdsa-nist-p521",
+		.cra_driver_name = "ecdsa-nist-p521-generic",
+		.cra_priority = 100,
+		.cra_module = THIS_MODULE,
+		.cra_ctxsize = sizeof(struct ecc_ctx),
+	},
+};
+
 static int ecdsa_nist_p384_init_tfm(struct crypto_akcipher *tfm)
 {
 	struct ecc_ctx *ctx = akcipher_tfm_ctx(tfm);

@@ -352,8 +374,15 @@ static int __init ecdsa_init(void)
 	if (ret)
 		goto nist_p384_error;
 
+	ret = crypto_register_akcipher(&ecdsa_nist_p521);
+	if (ret)
+		goto nist_p521_error;
+
 	return 0;
 
+nist_p521_error:
+	crypto_unregister_akcipher(&ecdsa_nist_p384);
+
 nist_p384_error:
 	crypto_unregister_akcipher(&ecdsa_nist_p256);
 

@@ -369,6 +398,7 @@ static void __exit ecdsa_exit(void)
 		crypto_unregister_akcipher(&ecdsa_nist_p192);
 	crypto_unregister_akcipher(&ecdsa_nist_p256);
 	crypto_unregister_akcipher(&ecdsa_nist_p384);
+	crypto_unregister_akcipher(&ecdsa_nist_p521);
 }
 
 subsys_initcall(ecdsa_init);
crypto/testmgr.c +7 -0
index c26aeda85787..a017b4ad119b 100644
@@ -5097,6 +5097,13 @@ static const struct alg_test_desc alg_test_descs[] = {
 		.suite = {
 			.akcipher = __VECS(ecdsa_nist_p384_tv_template)
 		}
+	}, {
+		.alg = "ecdsa-nist-p521",
+		.test = alg_test_akcipher,
+		.fips_allowed = 1,
+		.suite = {
+			.akcipher = __VECS(ecdsa_nist_p521_tv_template)
+		}
 	}, {
 		.alg = "ecrdsa",
 		.test = alg_test_akcipher,
crypto/testmgr.h +146 -0

152 lines not on this page · raw message

Signature · 1 line
2.43.0
author reviewer
#25 lore raw

PATCH v3 10/10 x509: Add OID for NIST P521 and extend parser for it

In reply to Stefan Berger

Prepare the x509 parser to accept NIST P521 certificates and add the OID for ansip521r1, which is the identifier for NIST P521.

Cc David Howells <[email protected]>
Signed-off-by Stefan Berger <[email protected]>
---
 crypto/asymmetric_keys/x509_cert_parser.c | 3 +++
 include/linux/oid_registry.h              | 1 +
 2 files changed, 4 insertions(+)
crypto/asymmetric_keys/x509_cert_parser.c +3 -0
index 487204d39426..99f809b7910b 100644
@@ -538,6 +538,9 @@ int x509_extract_key_data(void *context, size_t hdrlen,
 		case OID_id_ansip384r1:
 			ctx->cert->pub->pkey_algo = "ecdsa-nist-p384";
 			break;
+		case OID_id_ansip521r1:
+			ctx->cert->pub->pkey_algo = "ecdsa-nist-p521";
+			break;
 		default:
 			return -ENOPKG;
 		}
include/linux/oid_registry.h +1 -0
index 3921fbed0b28..af16d96fbbf2 100644
@@ -65,6 +65,7 @@ enum OID {
 	OID_Scram,			/* 1.3.6.1.5.5.14 */
 	OID_certAuthInfoAccess,		/* 1.3.6.1.5.5.7.1.1 */
 	OID_id_ansip384r1,		/* 1.3.132.0.34 */
+	OID_id_ansip521r1,		/* 1.3.132.0.35 */
 	OID_sha256,			/* 2.16.840.1.101.3.4.2.1 */
 	OID_sha384,			/* 2.16.840.1.101.3.4.2.2 */
 	OID_sha512,			/* 2.16.840.1.101.3.4.2.3 */
Signature · 1 line
2.43.0
maintainer
#26 lore raw
In reply to Stefan Berger
Quoted 9 lines · Stefan Berger

This series adds support for the NIST P521 curve to the ecdsa module.

An issue with the current code in ecdsa is that it assumes that input arrays providing key coordinates for example, are arrays of digits (a 'digit' is a 'u64'). This works well for all currently supported curves, such as NIST P192/256/384, but does not work for NIST P521 where coordinates are 8 digits + 2 bytes long. So some of the changes deal with converting byte arrays to digits and adjusting tests on input byte array lengths to tolerate arrays not providing multiples of 8 bytes.

Don't you also need to amend software_key_query()? In the "issig" case, it calculates len = crypto_sig_maxsize(sig), which is 72 bytes for P521, then further below calculates "info->max_sig_size = 2 * (len + 3) + 2;"

I believe the ASN.1 encoded integers are just 66 bytes instead of 72, so info->max_sig_size is 6 bytes too large. Am I missing something?

Thanks,

Lukas

author reviewer
#27 lore raw
Quoted 11 lines · Lukas Wunner
Quoted 9 lines · Stefan Berger

This series adds support for the NIST P521 curve to the ecdsa module.

An issue with the current code in ecdsa is that it assumes that input arrays providing key coordinates for example, are arrays of digits (a 'digit' is a 'u64'). This works well for all currently supported curves, such as NIST P192/256/384, but does not work for NIST P521 where coordinates are 8 digits + 2 bytes long. So some of the changes deal with converting byte arrays to digits and adjusting tests on input byte array lengths to tolerate arrays not providing multiples of 8 bytes.

Quoted 6 lines

Don't you also need to amend software_key_query()? In the "issig" case, it calculates len = crypto_sig_maxsize(sig), which is 72 bytes for P521, then further below calculates "info->max_sig_size = 2 * (len + 3) + 2;"

I believe the ASN.1 encoded integers are just 66 bytes instead of 72, so info->max_sig_size is 6 bytes too large. Am I missing something?

Right! Good catch. While the 'keyctl pkey_verify' interface was already working the space was too generous with 72 bytes. So I adjusted ecdsa_max_size now to base the size calculations on nbits rather than ndigits and we now get 66 bytes.

For so-far supported curves the max_sig_size is:

2 bytes for sequence (0x30) + following length as single byte
Each coordinate may have a 0 prepended to make a possibly negative number positive:

=> 2 + 2 * (2 + 1 + len)

In case of NIST P521 the max signature length is calculated as follows:

3 bytes for sequence (0x30) + following length as 2 bytes
The coordinates won't have a preprended 0 byte since only 1 bit is used in the highest bit, so only 2 bytes for

=> 3 + 2 * (2 + len)

We would have to adjust the math there as well. The max. signature size for NIST P521 is 139 rather than 140 with the first formula.

Stefan

Quoted 4 lines

Thanks,

Lukas